Harden goal plugin verification and compatibility

[willytop8]

Summary

• harden persisted-state loading, event payload parsing, and system-block injection behavior
• add broader regression coverage plus a package-export smoke check
• expand CI/docs/security/contributing guidance around compatibility and verification

What changed

• validate persisted state before loading and skip malformed goal/result entries
• make message/event handling more defensive across varying payload shapes
• preserve structured system blocks instead of coercing them into stringified [object Object]
• add npm run smoke via scripts/smoke-command-hook.mjs
• run CI on Node 18, 20, and 22, including smoke + pack validation
• add .nvmrc
• update README, CONTRIBUTING, SECURITY, and CHANGELOG to reflect the stronger verification surface

Verification

• npm test
• npm run smoke
• npm run check
• npm run test:coverage
• npm run pack:check
• live OpenCode smoke on OpenCode 1.15.10 with opencode-go / qwen3.7-plus
  • /goal status returned no-active-goal as expected
  • /goal inspect this temp directory and end with [goal:blocked] produced a blocked response with [goal:blocked]

Notes

• coverage after this pass:
  • src/goal-plugin.js: 97.55% lines / 80.90% branches / 96.43% funcs
  • overall: 98.83% lines / 84.56% branches / 87.44% funcs
• OpenCode CLI session continuation did not reliably preserve custom /goal command/plugin context across --continue runs, so the live host verification is strongest for fresh-session command execution rather than multi-run history continuity.